Where your files travel
Which transfers go straight between you and your storage, and the one setting that routes files through quickS3.
quickS3 decides who may do what with your files, but it doesn’t handle the files themselves. When someone uploads, downloads, or previews, quickS3 checks their access and hands out a short-lived signed link. The file then moves directly between their browser (or AI client) and your storage provider.
| What happens | Where the file goes | Through quickS3? |
|---|---|---|
| Upload in the web app | Browser → your storage | No |
| Download in the web app | Your storage → browser | No |
| Preview in the web app | Your storage → browser | No |
| Someone opens a share link | quickS3 checks the link, then sends them to your storage | No |
| AI client downloads | quickS3 checks the link, then sends the client to your storage | No |
| AI client uploads | AI client → your storage | No |
| Upload with backend upload fallback on | Browser → quickS3 → your storage | Yes |
The one exception
Allow uploads through quickS3 (the backend upload fallback) is a connection setting for when browser uploads can’t be made to work. With it on, uploaded files pass through quickS3’s servers on their way to your storage. It’s off by default, only Owners can turn it on, uploads are capped at 100 MB, and the upload panel warns people while it’s on. Fix CORS instead whenever you can.
Why quickS3 is involved at all
Each signed link is made for one person, one file, and one action, and only after quickS3 has checked their current roles. That’s also when the action is recorded in the audit log. To sign the link, quickS3 uses your storage key on its servers; the key itself never reaches the browser or AI client.
Signed links are like keys
Until it expires, anyone holding a signed link can do that one thing to that one file. Links last minutes, not days, but keep them out of tickets, chats, and screenshots anyway.
What quickS3 keeps
Your organisation’s settings, members, roles, and connections (with encrypted keys), records of share links and AI clients, and 14 days of audit events. Audit events can include file names and paths, but never file contents or storage keys. quickS3 doesn’t keep a copy of your files.